{
  "family": "banload",
  "sample_count": 288,
  "category": "downloader",
  "description": "TrojanDownloader:Win32/Banload is a devastating, widespread trojan downloader heavily utilized in massive malspam campaigns to deliver Brazilian banking trojans (like Zeus, SpyEye, or localized variants) onto compromised endpoints.<br><br><b>Understanding Banload</b><br>To the victim, Banload is entirely transparent; the damage occurs when their bank accounts are drained by the secondary payload. For threat intelligence analysts, Banload represents a critical component of the Latin American cybercrime ecosystem. It is an extremely persistent 'Initial Access Broker' tool. Its sole purpose is to execute, bypass detection, and download the massive, multi-megabyte banking trojan payloads from compromised infrastructure.<br><br><b>Execution and Evasion Strategies</b><br>Banload is almost exclusively distributed via massive phishing campaigns mimicking Brazilian financial institutions, tax authorities (Receita Federal), or telecom providers. The emails contain ZIP files or malicious links pointing to VBScript or executable droppers. Upon execution, Banload utilizes aggressive anti-analysis techniques to detect sandboxes. It drops a heavily packed payload, establishes persistence via Run keys, and connects to C2 infrastructure (often hosted on legitimate, but compromised, WordPress sites) to download the banking trojan. Banload frequently disables UAC and Windows Defender to ensure the banking trojan installs cleanly.<br><br><b>Indicators of Compromise (IoCs)</b><br>The impact is severe financial fraud. Threat hunters should investigate EDR alerts for 'Suspicious Process Injection' or the rapid creation of highly entropic files in user directories. Network logs will often reveal Banload reaching out to compromised domains using HTTP GET requests. The presence of unexpected, hidden scheduled tasks or unauthorized modifications to Windows Security Center registry keys are strong IoCs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1055",
    "T1562.001",
    "T1566.001",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; Banload's presence guarantees that a highly destructive banking trojan is either downloading or already active.",
    "Assist the user in immediately contacting their financial institutions to freeze accounts and monitor for fraudulent transactions.",
    "Capture a live memory image (RAM dump) to extract the injected Banload modules and identify the specific banking trojan downloaded.",
    "Rebuild the operating system from a known-clean image, as Brazilian banking trojans establish deep, persistent hooks that are difficult to remove."
  ],
  "what_to_avoid": [
    "Do not allow the user to access any online banking or financial portals while the machine is infected.",
    "Avoid closing the incident after quarantining Banload; you must locate and remediate the massive banking trojan it inevitably dropped."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}